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Claims 

What is claimed is: 



1 1 . A method for calculating application verb response times, comprising: 

2 (a) receiving packet data; 

3 (b) aggregating the packet data into flows; 

4 (c) identifying application verbs and information relating to them associated with 
jZ 5 the flows; and 

Q 6 (d) storing the information relating to the application verbs; 

2 7 (e) wherein the information relating to the application verbs is capable of being used 
f7 8 to calculate response times associated therewith. 

p 1 2. The method as recited in claim 1 , and further comprising determining whether 
jr 2 the packet data is associated with a new flow. 

ry 1 3 . The method as recited in claim 2, wherein if the packet data is determined to be 

2 associated with a new flow, further comprising creating a flow, creating a data 

3 structure, and inserting the data structure into the flow. 

1 4. The method as recited in claim 3, wherein the creation of the data structure 

2 includes identifying a protocol identifier associated with the flow, and 

3 determining a number of known application verbs associated with the protocol 

4 identifier. 
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1 5 . The method as recited in claim 4, wherein the creation of the data structure 

2 further includes allocating memory for the data structure based on the number of 

3 known application verbs associated with the protocol identifier. 

1 6. The method as recited in claim 4, wherein the number of application verbs 

2 associated with the protocol identifier is determined utilizing a map. 

1 7. The method as recited in claim 6, wherein the map maps to a RMON tree. 

1 8. The method as recited in claim 1 , and further comprising inserting a data 

2 structure into the flows. 

1 9. The method as recited in claim 8, wherein the aggregation includes populating 

2 and updating the data structure with the information. 

1 10. The method as recited in claim 9, wherein the aggregation further includes 

2 identifying application verbs, determining whether the application verbs are 

3 valid, and updating a state machine if it is determined that the application verbs 

4 are valid. 

1 11. The method as recited in claim 9, wherein the aggregation further includes 

2 determining whether a response is complete, and calculating a response time if it 

3 is determined that the response is complete. 

1 12. The method as recited in claim 1 0, wherein the aggregation further includes 

2 determining whether the state machine is in a valid state, and utilizing the state 

3 machine as being representative of the response time if it is determined that the 

4 state machine is in a valid state. 
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1 13. The method as recited in claim 1 , wherein the information relating to the 

2 application verbs is capable of being used to calculate response times associated 

3 therewith in real-time. 

1 14. A computer program product for calculating application verb response times, 

2 comprising: 

3 (a) computer code for receiving packet data; 

4 (b) computer code for aggregating the packet data into flows; 

5 (c) computer code for identifying information relating to application verbs 

6 associated with the flows; and 

7 (d) computer code for storing the information relating to the application verbs; 

8 (e) wherein the information relating to the application verbs is capable of being used 

9 to calculate response times associated therewith. 

1 15. The computer program product as recited in claim 14, and further comprising 

2 computer code for determining whether the packet data is associated with a new 

3 flow. 

1 16. The computer program product as recited in claim 15, wherein if the packet data 

2 is determined to be associated with a new flow, further comprising computer 

3 code for creating a flow, creating a data structure, and inserting the data structure 

4 into the flow. 

1 1 7. The computer program product as recited in claim 1 6, wherein the creation of 

2 the data structure includes identifying a protocol identifier associated with the 

3 flow, and determining a number of application verbs associated with the 

4 protocol identifier. 
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1 18. The computer program product as recited in claim 17, wherein the creation of 

2 the data structure further includes allocating memory for the data structure based 

3 on the number of known application verbs associated with the protocol 

4 identifier. 

1 19. The computer program product as recited in claim 17, wherein the number of 

2 known application verbs associated with the protocol identifier is determined 

3 utilizing a map. 

1 20. The computer program product as recited in claim 1 9, wherein the map maps to 

2 aRMONtree. 

1 21 . The computer program product as recited in claim 14, and further comprising 

2 computer code for inserting a data structure into the flows. 

1 22. The computer program product as recited in claim 2 1 , wherein the aggregation 

2 includes populating and updating the data structure with the information. 

1 23 . The computer program product as recited in claim 22, wherein the aggregation 

2 further includes identifying application verbs, determining whether the 

3 application verbs are valid, and updating a state machine if it is determined that 

4 the application verbs are valid. 

1 24. The computer program product as recited in claim 22, wherein the aggregation 

2 further includes determining whether a response is complete, and calculating a 

3 response time if it is determined that the response is complete. 
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1 


25. 


The computer program product as recited in claim 23, wherein the aggregation 


2 




further includes determining whether the state machine is in a valid state, and 


3 




utilizing the state machine as being representative of the response time if it is 


4 




determined that the state machine is in a valid state. 


1 


26. 


The computer program product as recited in claim 14, wherein the information 


2 




relating to the application verbs is capable of being used to calculate response 


3 




times associated therewith in real-time. 


1 


27. 


A system for calculating application verb response times, comprising: 


2 


(a) 


means for receiving packet data; 


3 


(b) 


means for aggregating the packet data into flows; 


4 


(c) 


means for identifying information relating to application verbs associated with 


5 




the flows; and 


6 


(d) 


means for storing the information relating to the application verbs; 


7 


(e) 


wherein the information relating to the application verbs is capable of being used 


8 




to calculate response times associated therewith. 


1 


28. 


A data structure for calculating application verb response times, comprising: 


2 


(a) 


a plurality of application verb objects for identifying information relating to 


3 




application verbs associated with a flow; and 


4 


(b) 


a state machine object; 


5 


(c) 


wherein the application verb objects and the state machine object are capable of 


6 




beine used to validate restionse times 


1 


29. 


A method for calculating response times, comprising: 


2 


(a) 


receiving packet data; 


3 


(b) 


aggregating the packet data into a flow; 
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4 


(c) 


identifying information relating to application verbs associated with the flow; 




5 


(d) 


storing the information relating to the application verbs in a data structure; 




6 


(e) 


inserting the data structure in the flow; and 




7 


(f) 


mapping the data structure to a remote monitoring (RMON) tree. 




1 


30. 


A method for calculating response times, comprising: 




2 


(a) 


receiving packet data; \ 




3 


(b) 


determining whether the packet data is associated with a new flow; 




4 


(c) 


if the packet data is determined to be associated with a new flow: 




5 




(0 


creating a flow, 




6 




(ii) 


providing a notification of the flow, 


5 - I 
■:. ■:. . : 


7 




(iii) 


creating a data structure in response to the notification, the creation of the 




8 






data structure including: 


y= 


9 






1) identifying a protocol identifier associated with the flow, 


s 


10 






2) caching the protocol identifier, 




11 






3) determining a number of known application verbs associated with 


□ 


12 






the protocol identifier, and 




13 






4) allocating memory for the data structure based on the number of 




14 






known application verbs associated with the protocol identifier, 




15 






and 




16 




(iv) 


inserting the data structure into the flow; and 




17 


(d) 


aggregating the packet data by: 




18 




(i) 


identifying application verbs in the flow, 




19 




(ii) 


determining whether the application verbs are valid, 




20 




(iii) 


updating a state machine if it is determined that the application verbs are 




21 






valid, 




22 




(iv) 


determining whether a response associated with the flow is complete, 
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23 (v) calculating a response time if it is determined that the response is 

24 complete, 

25 (vi) determining whether the state machine is in a valid state, and 

26 (vii) utilizing the data structure as being representative of the response time if 

27 it is determined that the state machine is in a valid state. 



HI 
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